\subsection{Policy Update}
\label{sec:PolicyUpdate}

 A runtime update of Security Rules is managed by simply adding (or retracting) the Security Rules from the policy engine (and their associated facts), i.e. if an obligation rule is removed then all its activated instances are also removed. When a new class is added (or removed) to the declarations part of the configuration, then the instances of this class are added to (or removed from) the knowledge base of the \textsc{Pdp} as discussed in Section~\ref{sec:representation}. Similarly, when an attribute is added (or removed), then the facts representing it are added (or retracted). A method call that is declared (undeclared) starts (ceases) to be monitored by the \textsc{Pep}. To handle these updates to declared classes and attributes, we need to keep a map of the class instances of the application at the \textsc{Pep} level.